CVE-2026-103437 in ReadingLists Extension
Summary
by MITRE • 09/30/2026
Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki ReadingLists extension allows Reflected XSS.
This issue affects MediaWiki ReadingLists extension: 1.46 and 1.45.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/30/2026
The identified security flaw represents a classic instance of improper neutralization of script-related HTML tags within web pages, commonly categorized under the Common Weakness Enumeration as CWE-79 Improper Neutralization of Script-Related HTML Tags in a Web Page. This vulnerability specifically impacts the MediaWiki ReadingLists extension for versions 1.46 and 1.45 maintained by The Wikimedia Foundation. At its core, this is a reflected cross-site scripting issue where user-supplied input is not adequately sanitized or validated before being included in the application's response to the browser. When an attacker crafts a malicious URL containing embedded JavaScript code as part of the query parameters or path segments directed at the vulnerable endpoint, the server processes the request and reflects the untrusted data back into the HTML output without proper encoding. This behavior allows the injected script to execute within the context of the victim's browser session whenever they interact with the specially crafted link.
From a technical perspective, the root cause lies in the failure to apply appropriate output encoding mechanisms such as HTML entity encoding or JavaScript string escaping for dynamic content derived from user input. In many web applications built on MediaWiki, extensions often handle various forms of data including search queries, filter parameters, and list identifiers. If the ReadingLists extension fails to distinguish between safe literal text and executable script fragments when rendering these values in the DOM, it creates an injection vector. The reflected nature of this XSS means that exploitation typically requires social engineering or phishing tactics where a victim is persuaded to click on a maliciously constructed URL hosted by an attacker. Once clicked, the browser parses the response from the server, interprets the embedded script as legitimate code belonging to the site's domain, and executes it immediately.
The operational impact of this vulnerability can be severe depending on the privileges associated with the victim account. An attacker who successfully exploits this flaw gains the ability to execute arbitrary JavaScript in the context of the affected website. This capability enables a range of malicious activities including session hijacking where the attacker steals authentication cookies or tokens, credential harvesting by injecting fake login forms that capture user credentials, and defacement of the user interface through DOM manipulation. Furthermore, if the victim has administrative privileges within the MediaWiki environment, the impact escalates significantly as the attacker could potentially perform actions on behalf of an administrator, leading to broader system compromise or data exfiltration from the wiki platform. The attack vector is classified under MITRE ATT&CK technique T1059 Command and Scripting Interpreter specifically for JavaScript execution within a browser context, highlighting its potential use in subsequent stages of an intrusion campaign such as persistence establishment or lateral movement if other vulnerabilities exist on the same domain.
To mitigate this vulnerability, immediate patching to a version of the MediaWiki ReadingLists extension that addresses this flaw is required. Developers must ensure that all user-supplied data reflected in HTML responses undergoes rigorous encoding processes tailored to the context where it will be rendered. This includes using established libraries or framework functions designed for safe output encoding rather than relying on custom, potentially flawed sanitization logic. Additionally implementing a Content Security Policy with strict directives can provide an additional layer of defense by restricting the sources from which scripts are allowed to load and execute, thereby neutralizing many XSS attacks even if they bypass input validation measures. Regular security audits and code reviews focusing on data flow analysis should be conducted to identify similar patterns in other parts of the application that might expose users to reflected or stored cross-site scripting risks.